Compromise Hardware Supply Chain
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
MITRE's own strategy title ("via Host Status & Boot Integrity Checks") names the real signal as boot attestation against a known-good hardware/firmware baseline, which is not something a Windows event log, Sysmon feed or auditd stream carries at all -- it requires a TPM/PCR attestation report compared out-of-band, not a log event. What the brief substitutes instead does not hold up: AN1035's Windows log source pairs EventID 1166 (not a documented Windows Security event -- no such ID exists in the standard Security channel) with EventID 7045, which is real but is written to the System log by the Service Control Manager, not to Security where the brief's sigmaLogsource places it -- the same wrong-channel trap AUTHORING.md section 12 warns about, just with an invented ID instead of a Sysmon-shaped category. […]
What the technique is
Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1035
Detects tampered hardware or firmware via anomalous host status telemetry. Behavioral chain: (1) Pre-OS or firmware components exhibit unexpected version changes, signature failures, or modified boot paths; (2) System management/firmware tools log hardware inventory drift; (3) Sensor health telemetry or boot attestation events fail baseline checks; (4) Follow-on process execution from altered firmware or unknown drivers after boot.
- AN1036
Monitors for hardware or firmware tampering by correlating system boot logs, hardware inventory changes, and secure boot/firmware verification failures. Behavioral chain: (1) UEFI/BIOS version drift; (2) secure boot disabled or signature verification errors; (3) unexpected modules or hardware devices enumerated at boot; (4) new device firmware images loaded from non-approved sources.
- AN1037
Detects tampered Mac hardware/firmware by analyzing unified logs, EndpointSecurity events, and Apple Mobile File Integrity (AMFI) checks. Behavioral chain: (1) Boot process reports firmware signature mismatch; (2) Secure Boot policy altered; (3) new EFI drivers or hardware devices appear in inventory; (4) system extension loads from unapproved developer IDs post-boot.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.